[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Services Acquisition?

[Assistant]
According to Automation Support for Security Control Assessments_ Volume 2_ Hardware Asset Management:

There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may be used by federal agencies even before the completion of such companion publications. Thus, until each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For planning and transition purposes, federal agencies may wish to closely follow the development of these new publications by NIST. The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the Nation's measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof-of-concept implementations, and technical analyses to advance the development and productive use of information technology. ITL's responsibilities include the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national security-related information in federal systems. The authors, Kelley Dempsey of the National Institute of Standards and Technology (NIST), Dr. George Moore of the Applied Physics Laboratory at Johns Hopkins University, and Paul Eavy of the Department of Homeland Security, wish to thank their colleagues who reviewed drafts of this document, including Nathan Aileo, Nadya Bartol, Craig Chase, Ann Dixon, Terry Fletcher, Jim Foti, John Groenveld, Susan Hansche, Alicia Jones, Amy Heydman, Elizabeth Lennon, Jaime Miller, Susan Pagan, Daniel Portwood, Ron Ross, Martin Stanley, Kevin Stine, Robin Walker, David Waltermire, Kimberly Watson, and Jim Wiggins .

Automation Support for Security Control Assessments_ Volume 2_ Hardware Asset Management


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Access Control?

[Assistant]
According to Measurement Guide for Information Security_ Volume 2 — Developing an Information Security Measurement Program:

| 1. Introduction...................................................................................................................................1                                                                                |
|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| 2. Fundamentals ................................................................................................................................3                                                                                |
| 2.4.1. Chief Executive Officer/Agency Head...........................................................................................6                                                                                |
| 2.4.2. Chief Information Officer .............................................................................................................7                                                                                |
| 2.4.3. Chief Information Security Officer ...............................................................................................7                                                                                |
| 2.4.4. Program Managers and System Owners......................................................................................8                                                                                |
| 2.4.5.

Measurement Guide for Information Security_ Volume 2 — Developing an Information Security Measurement Program


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Workshop Summary Report for “Cybersecurity Risks in Consumer Home Internet of Things (IoT) Products” Virtual Workshop provide? (Part 4)

[Assistant]
This publication may also help IoT device customers or integrators who are incorporating IoT devices intended for the home market into their residence or business, especially small business networks.
## Acknowledgments

The authors wish to thank all contributors to this publication, including the participants in this workshop and other interactive sessions; the individuals and organizations from the public and private sectors, including manufacturers for various sectors and several manufacturer trade organizations who provided feedback on the preliminary public content; and colleagues at NIST, The MITRE Corporation, and Scarfone Cybersecurity who offered invaluable input and expertise. ## Table of Contents

| 1                  | Introduction ............................................................................................................1                                                                                |
|--------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| 2                  | Workshop................................................................................................................

Workshop Summary Report for “Cybersecurity Risks in Consumer Home Internet of Things (IoT) Products” Virtual Workshop

Planning
System and Services Acquisition
Physical Protection
Awareness and Training
Incident Response
Supply Chain Risk Management
Configuration Management
Maintenance
Security Assessment
System and Communications Protection
Media Protection
Risk Assessment
Audit and Accountability
Personnel Security
Identification and Authentication
Access Control
System and Information Integrity


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Communications Protection?

[Assistant]
According to Guide to Operational Technology (OT) Security:

Keith Stouffer
Michael Pease
CheeYee Tang
Timothy Zimmerman
Smart Connected Systems Division
Communications Technology Laboratory

6.2.9.  Wireless Communications ..................................................................................... 120

6.4.2.  Response Communications (RS.CO) .................................................................... 134

Guide to Operational Technology (OT) Security


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Guide for Mapping Types of Information and Information Systems to Security Categories_ Appendices provide? (Part 2)

[Assistant]
en developed by the National Institute of Standards and Technology (NIST) to further its statutory responsibilities under the Federal Information Security Management Act (FISMA) of 2002, P.L. 107-347.
NIST is responsible for developing standards and guidelines, including minimum requirements, for providing adequate information security for all agency operations and assets, but such standards and guidelines shall not apply to national security systems. This guideline is consistent with the requirements of the Office of Management and Budget (OMB) Circular A-130, Section 8b(3), Securing Agency Information Systems, as analyzed in A-130, Appendix IV: Analysis of Key Sections. Supplemental information is provided in A-130, Appendix III. This guideline has been prepared for use by federal agencies. It may also be used by nongovernmental organizations on a voluntary basis and is not subject to copyright. (Attribution would be appreciated by NIST.)

Nothing in this document should be taken to contradict standards and guidelines made mandatory and binding on federal agencies by the Secretary of Commerce under statutory authority. Nor should these guidelines be interpreted as altering or superseding the existing authorities of the Secretary of Commerce, Director of the OMB, or any other federal official. NIST Special Publication 800-60 Volume II, Revision 1, 304 pages

(Date) CODEN: NSPUE2

Certain  commercial  entities,  equipment,  or  materials  may  be  identified  in  this  document  in  order  to  describe  an experimental  procedure  or  concept  adequately. Such  identification  is  not  intended  to  imply  recommendation  or endorsement by the National Institute of Standards and Technology, nor is it intended to imply that the entities, materials, or equipment are necessarily the best available for the purpose.

Guide for Mapping Types of Information and Information Systems to Security Categories_ Appendices


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Audit and Accountability?

[Assistant]
According to Metrics and Key Performance Indicators for Robotic Cybersecurity Performance Analysis:

The Testbed LAN has three machines: a probe server, source control management (SCM) server, and Network Time Protocol (NTP) and Precision Time Protocol (PTP) capable master clock. The probe server ('ORION') consumes and records network traffic from twelve independent network interfaces. The SCM server ('RIGEL') runs a GitLab server to track and maintain the code used on the enclave, primarily robot code, PLC code, and analysis tools. The NTP/PTP clock ('GEORGE') provides stable time to the enclave servers and systems to enable synchronized logging.

Metrics and Key Performance Indicators for Robotic Cybersecurity Performance Analysis


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Guidelines on Firewalls and Firewall Policy provide? (Part 5)

[Assistant] | Overview of Firewall Technologies ................................................................................2-1 | Overview of Firewall Technologies ................................................................................2-1 | | | | Firewall Technologies ..............................................................................................2-2 | Firewall Technologies ..............................................................................................2-2 | | | 2.1 | 2.1.1 | Packet Filtering.............................................................................................2-2 | | | | 2.1.2 | Stateful Inspection........................................................................................2-4 | | | | 2.1.3 | Application Firewalls.....................................................................................2-5 | | | | 2.1.4 | Application-Proxy Gateways.........................................................................2-6 | | | | 2.1.5 | Dedicated Proxy Servers..............................................................................2-6 | | | | 2.1.6 | Virtual Private Networking | ............................................................................2-7 | | | 2.1.7 | Network Access Control ...............................................................................2-8 | | | | 2.1.8 | Unified Threat Management (UTM)..............................................................2-9 | | | | 2.1.9 | Web Application Firewalls | ............................................................................2-9 | | | 2.1.10 | Firewalls for Virtual Infrastructures | ...............................................................2-9 | | | 2.2 | Firewalls for Individual Hosts and Home Networks................................................2-10 | | | | | 2.2.1 Host-Based Firewalls and Personal Firewalls ............................................2-10 | | | | 2.2.2 | Personal Firewall Appliances .....................................................................2-11 | | | | 2.3 | Limitations of Firewall Inspection...........................................................................2-11 | | | | Summary of Recommendations.............................................................................2-12 | Summary of Recommendations.............................................................................2-12 | | | 3.

Guidelines on Firewalls and Firewall Policy


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Configuration Management?

[Assistant]
According to Managing Information Security Risk_ Organization, Mission, and Information System View:

the third option is limited by the ability of organizations to detect potential insertion of malware into the hardware, firmware, or software. As such, it is the least effective of the three options.
From a cost perspective, the first option is potentially the most expensive, depending upon the number of travelers (hence number of travel laptops) required. The second and third options are considerably less expensive. From a mission and operational perspective, the third option is the best alternative as users have access to standard laptop configurations including all applications and supporting data needed to perform tasks supporting missions and business functions. Such applications and data would not be available if the first or second option is selected. Ultimately, the evaluation of courses of action is made based on operational requirements, including information security requirements, needed for near and long term mission/business success. Budgetary constraints, consistency with investment management strategies, civil liberties, and privacy protection, are some of the important elements organizations consider when selecting appropriate courses of action. In those instances where organizations only identify a single course of action, then the evaluation is focused on whether the course of action is adequate. If the course of action is deemed inadequate, then organizations need to refine the identified course of action to address the inadequacies or develop another course of action (see Task 3-1).

Managing Information Security Risk_ Organization, Mission, and Information System View


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Identification and Authentication?

[Assistant]
According to Case Studies in Cyber Supply Chain Risk Management_ Summary of Findings and Recommendations:

nication and engagement with executive leadership. This team should leverage existing organizational expertise, like information security and compliance functions, when holistically assessing risk. 5.
Do not wait to build deep supplier relationships : Direct points of contact and familiarity with a supplier's business are essential to understanding risks and ensuring rapid incident response. Strengthening such relationships can also foster loyalty, ensure effective supplier management, and support operational efficiencies. Organizations should also regularly stress test their Incident Response Plans and perform tabletop exercise simulations with their suppliers.

Case Studies in Cyber Supply Chain Risk Management_ Summary of Findings and Recommendations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Security Assessment?

[Assistant]
According to Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations:

ISCM, a critical step in an organization's Risk Management Framework (RMF), gives organizational officials access to security-related information on demand, enabling timely risk management decisions, including authorization decisions. Frequent updates to security plans, security assessment reports, plans of action and milestones, hardware and software inventories, and other system information are also supported. ISCM is most effective when automated mechanisms are employed where possible for data collection and reporting. Effectiveness is further enhanced when the output is formatted to provide information that is specific, measurable, actionable, relevant, and timely. While this document encourages the use of automation, it is recognized that many aspects of ISCM programs are not easily automated. The output of a strategically designed and well -managed organization-wide ISCM program can be used to maintain a system's authorization to operate and keep required system information and data (i.e., System Security Plan together with Risk Assessment Report, Security Assessment Report, and POA&M) up to date on an ongoing basis. Security management and reporting tools may provide functionality to automate updates to key evidence needed for ongoing authorization decisions. ISCM also facilitates risk-based decision making regarding the ongoing authorization to operate information systems and security authorization for common controls by provid ing evolving threat activity or vulnerability information on demand. A security control assessment and risk determination process, otherwise static between authorizations, is thus transformed into a dynamic process that supports timely risk response actions and cost-effective, ongoing authorizations. Continuous monitoring of threats, vulnerabilities, and security control effectiveness provides situational awareness for risk-based support of ongoing authorization decisions.

Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AT.L2-3.2.2 (NIST 3.2.2)?

[Assistant]
According to Minimum Security Requirements for Multi-User Operating Systems:

3.2.2                             | Resource Access Control                     | 3-10    |
|                                |                                | 3. 3.2.2. 3.2.2 Resource Access Control

Once the user has been granted access to the system as a whole, the question of which resources that authenticated user may access still remains.

Minimum Security Requirements for Multi-User Operating Systems


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Risk Assessment?

[Assistant]
According to Guide for Mapping Types of Information and Information Systems to Security Categories_ Appendices:

1 This document is currently under revision and will be reissued as Special Publication 800-30, Revision 1, Guide for Conducting Risk Assessments .

The provisional security impact level assignments contained in appendices C and D are only the first step in impact assignment and subsequent risk assessment processes.  The impact assignments are not intended to be used by auditors as a definitive checklist for information types and impact assignments.

The level of impact on organizational operations (including mission, functions, image, or reputation), organizational assets, individuals, other organizations, or the Nation resulting from the operation of an information system given the potential impact of a threat and the likelihood of that threat occurring. [FIPS 200, Adapted]


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Maintenance?

[Assistant]
According to Guide to Integrating Forensic Techniques into Incident Response:

es, cost, response time, and data sensitivity. - ! Incident handling teams should have robust forensic capabilities. More than one team member should be able to perform each typical forensic activity.
Hands-on exercises and IT and forensic training courses can be helpful in building and maintaining skills, as can demonstrations of new tools and technologies. - ! Many teams within an organization should participate in forensics. Individuals performing forensic actions should be able to reach out to other teams and individuals within an organization, as needed, for additional assistance. Examples of teams that may provide assistance in these efforts include IT professionals, management, legal advisors, human resources personnel, auditors, and physical security staff. Members of these teams should understand their roles and

Guide to Integrating Forensic Techniques into Incident Response


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Zero Trust Architecture provide? (Part 3)

[Assistant]
ores disponibles para el propósito. En esta publicación puede haber referencias a otras que actualmente están siendo desarrolladas por NIST de acuerdo con sus responsabilidades estatutarias asignadas.
La información contenida en esta publicación, incluidos conceptos y  metodologías,  puede  ser  utilizada  por  los  organismos  federales  incluso  antes  de  la  finalización  de  dichas publicaciones  complementarias. Por  lo  tanto,  hasta  que  se  finalice  cada  publicación,  los  requisitos,  directrices  y procedimientos  actuales,  cuando  existan,  seguirán  siendo  operativos. A  efectos  de  planificación  y  transición,  los organismos federales pueden seguir de cerca el desarrollo de estas nuevas publicaciones del NIST. Se anima a las organizaciones a revisar todos los borradores de publicaciones durante los periodos de comentarios públicos y proporcionar retroalimentación al NIST. Muchas publicaciones sobre ciberseguridad del NIST, aparte de las mencionadas anteriormente, están disponibles en https://csrc.nist.gov/publications. ## Los comentarios sobre esta publicación pueden enviarse a

Instituto Nacional de Estándares y Tecnología A la atención de: Advanced Network Technologies Division, Information Technology Laboratory

100 Bureau Drive (Mail Stop 8920) Gaithersburg, MD 20899-8920

Correo electrónico: zerotrust-arch@nist.gov

Todos los comentarios están sujetos a la Ley de Libertad de Información (FOIA). ## Informes sobre tecnología de sistemas informáticos

El  Laboratorio  de  Tecnología  de  la  Información  (ITL,  por  su  nombre  en  inglés,  Information Technology Laboratory) del Instituto Nacional de Estándares y Tecnología (NIST) promueve la economía  y  el  bienestar  público  de  Estados  Unidos  a  través  de  su  liderazgo  técnico  en  la infraestructura  de  medición  y  normalización  del  país.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What guidance does Guide for Conducting Risk Assessments provide?

[Assistant]
NIST Special Publication 800-30 Revision 1

<!-- image -->

## Guide for Conducting Risk Assessments

JOINT TASK FORCE TRANSFORMATION INITIATIVE

## I N F O R M A T I O N     S E C U R I T Y

Computer Security Division Information Technology Laboratory National Institute of Standards and Technology Gaithersburg, MD 20899-8930

September 2012

<!-- image -->

## U.S. Department of Commerce

Rebecca M. Blank, Acting Secretary

## National Institute of Standards and Technology

Patrick D. Gallagher, Under Secretary for Standards and Technology and Director

\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

## Reports on Computer Systems Technology

The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the nation's measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analyses to advance the development and productive use of information technology. ITL's responsibilities include the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national security-related information in federal information systems. The Special Publication 800-series reports on ITL's research, guidelines, and outreach efforts in information system security, and its collaborative activities with industry, government, and academic organizations.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Security Assessment?

[Assistant]
According to Standard Security Label for GOSIP_ an Invitational Workshop:

The paper presents several alternative strategies for a building a Multipolicy Machine. It explores the critical metapolicy concept and raises issues about technical feasibility, control, NCSC acceptance, evaluation and export

The Trusted Computer System Evaluation Criteria (TCSEC or Orange Book) defines the United States' security paradigm. It assumes a single 'system security policy' which is divided into three major subpolicies: Confidentiality, Integrity, and Assurance of Service. The subpolicies are further subdivided. Confidentiality is divided into Access Control and Non-Access Control policies. Access Control policies are subdivided into Mandatory Access Control (MAC) and Discretionary Access Control (DAC). However, the paradigm assumes that all these subpolicies cohere together to represent one overall system security policy. The single overall policy drives the choice of security mechanisms and is the foundation of most assurance efforts.

Handle bottom-up system construction. The end-user, supposedly the originator of the system security policy, can't change the security policy already implemented without reevaluation. The end-user must purchase components with security policies that come close to his needs, but a perfect match is unlikely. We need a paradigm which permits the end-user to establish his own security policy in a near-match system without requiring a reevaluation of the whole system.

Standard Security Label for GOSIP_ an Invitational Workshop


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Audit and Accountability?

[Assistant]
According to Attribute-based Access Control for Microservices-based Applications using a Service Mesh:

- Multiple, loosely coupled microservices communicate through network calls, and these communication links must be protected. In the case of monolithic applications, these communications take place through procedure calls.
- The entire network and all microservices are untrusted. Therefore, mutual authentication and secure communication channels between microservices through mechanisms such as mutual Transport Layer Security (TLS) (mTLS) are required.
- The logging data that pertains to each microservice must be consolidated to obtain a security profile in order for forensics, audits, and analytics to assess the overall health of the application.

Microservices-based applications require several application infrastructure and security services, such as authentication, authorization, monitoring, logging, auditing, traffic control, caching, secure ingress, service-to-service, and egress communication. The reference hosting platform with interfaces for efficiently scheduling and running the multiple services of an application lacks the interfaces to run a set of application infrastructure services in a coordinated and consistent manner. Moreover, the following advantages of API architecture are not fully leveraged in the reference platform [8]:

ISMC-SR-1 : If certificate-based authentication is used for authenticating service calls, the signing certificate used by the service mesh's CA module should be rooted in the organization's existing Public Key Infrastructure (PKI) to allow for auditability, rotation, and revocation.

Attribute-based Access Control for Microservices-based Applications using a Service Mesh


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Services Acquisition?

[Assistant]
According to Automation Support for Security Control Assessments_ Software Vulnerability Management:

There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may  be  used  by  federal  agencies  even  before  the  completion  of  such  companion  publications. Thus,  until  each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For planning  and  transition  purposes,  federal  agencies  may  wish  to  closely  follow  the  development  of  these  new publications by NIST. The  Information  Technology  Laboratory  (ITL)  at  the  National  Institute  of  Standards  and Technology  (NIST)  promotes  the  U.S. economy  and  public  welfare  by  providing  technical leadership  for  the  Nation's  measurement  and  standards  infrastructure. ITL  develops  tests,  test methods, reference data, proof of concept implementations, and technical analyses to advance the development  and  productive  use  of  information  technology. ITL's  responsibilities  include  the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national security-related information in federal information systems. The authors-Kelley Dempsey and Eduardo Takamura of the National Institute of Standards and Technology (NIST), Paul Eavy of the Department of Homeland Security, and Dr. George Moore-wish to thank their colleagues who reviewed drafts and assisted in the production of this document, including Nathan Aileo, Ujwala Arikatla, Jim Foti, Ned Goren, John Groenveld, Frank Husson, Jaime Miller, Susan Pagan, Ron Ross, David Waltermire, Kimberly Watson, Isabel Van Wyk, Brett Kreider, Nate Lee, Jim Finegan, and Nolda Dooley.

Automation Support for Security Control Assessments_ Software Vulnerability Management


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Information Integrity?

[Assistant]
According to Guide to Protecting the Confidentiality of Personally Identifiable Information (PII):

The security objectives of integrity and availability are equally important for PII, and organizations should use the NIST Risk Management Framework 28 to determine the appropriate integrity and availability impact levels. Organizations may also need to consider PII-specific enhancements to the integrity or availability impact levels. Accuracy is a required Fair Information Practice for most PII, and the security objective of integrity helps to ensure accuracy. Integrity is also important for preventing harm to the individual and the organization. For example, unauthorized alterations of medical records could endanger individuals' lives, and medical mistakes based on inaccurate information can result in liability to the organization and harm to its reputation. Some PII does not need to have its confidentiality protected, such as information that the organization has permission or authority to release publicly (e.g., an organization publishing a phone directory of employees' names and work phone numbers so that members of the public can contact them directly). In this case, the PII confidentiality impact level would be not applicable and would not be used to supplement a system's provisional confidentiality impact level. PII that does not require confidentiality protection may still require other security controls to protect the integrity and the availability of the information, and the organization should provide appropriate security controls based on the assigned FIPS 199 impact levels. -The potential impact is LOW if the loss of confidentiality, integrity, or availability could be expected to have a limited adverse effect on organizational operations, organizational assets, or individuals.

Guide to Protecting the Confidentiality of Personally Identifiable Information (PII)


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Access Control?

[Assistant]
According to An Introduction to Privacy Engineering and Risk Management in Federal Systems:

| Executive Summary.............................................................................................. | Executive Summary.............................................................................................. | Executive Summary..............................................................................................

An Introduction to Privacy Engineering and Risk Management in Federal Systems


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Risk Assessment?

[Assistant]
According to Recommendation for Applications Using Approved Hash Algorithms:

As described in Section 5.2, the overall security strength of a digital signature is limited by the collision resistance strength of the hash function. However, when using the randomized hashing technique specified in SP 800-106 [SP 800-106], a randomized hash function may support a higher level of security with respect to a particular potential vulnerability, offering enhanced protection to a message signer against a collision attack by a malicious message preparer who formulates the message to be signed, but does not actually sign the message.

Recommendation for Applications Using Approved Hash Algorithms


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Awareness and Training?

[Assistant]
According to Approaches for Federal Agencies to Use the Cybersecurity Framework:

ybersecurity and other risks to be managed and facilitate communication among agency stakeholders, including executive leadership. 4 This use example aggregates elements of the activities of uses 2-8.
| Summary: Using the Cybersecurity Framework's Functions (Identify, Protect, Detect, Respond, and Recover) as the basis for risk management dialogues related to the cybersecurity environment, organizations can raise awareness of cybersecurity and other risks to be managed and facilitate communication among agency stakeholders, including executive leadership. 4 This use example aggregates elements of the activities of uses 2-8. |
| Typical Participants: Head of Agency (Chief Executive Officer), Risk Executive (Function), Chief Information Officer (CIO), Senior Information Security Officer/Chief Information Security Officer                                                                                | Typical Participants: Head of Agency (Chief Executive Officer), Risk Executive (Function), Chief Information Officer (CIO), Senior Information Security Officer/Chief Information Security Officer                                                                                |

Approaches for Federal Agencies to Use the Cybersecurity Framework


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Identification and Authentication?

[Assistant]
According to Summary Report for the Virtual Workshop Addressing Public Comment on NIST Cybersecurity for IoT Guidance:

Mr. Brady explained that OLIR applies set theory concepts for defining relationships as a mechanism to reduce subjectivity and retains the identity of the SME that defined each relationship. The program, defined in NISTIRs 8278 [NISTIR8278] and 8278A [NISTIR8278A], has a standardized process for submitting OLIRs to be added to the database. He noted that documentation of an IR in OLIR does not demonstrate certification or compliance to the NIST document in question.

Personal Identity Verification

Summary Report for the Virtual Workshop Addressing Public Comment on NIST Cybersecurity for IoT Guidance


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Identification and Authentication?

[Assistant]
According to Interfaces for Personal Identity Verification_ Part 3 – PIV Client Application Programming Interface:

## Interfaces for Personal Identity Verification

## Interfaces for Personal Identity Verification

Ferraiolo H, Mehta K, Francomacaro S, Chandramouli R, Gupta S (2024) Interfaces for Personal Identity Verification: Part 3 - PIV Client Application Programming Interface. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) NIST SP 800-73pt3-5. https://doi.org/10.6028/NIST.SP.800-73pt3-5

Interfaces for Personal Identity Verification_ Part 3 – PIV Client Application Programming Interface


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Communications Protection?

[Assistant]
According to Cybersecurity Framework Profile for Electric Vehicle Extreme Fast Charging Infrastructure:

| | Introduction .........................................................................................................................1 | Introduction .........................................................................................................................1 | |---------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------| | | Purpose.........................................................................................................................2 | | | | Scope............................................................................................................................2 | | | | Audience | .......................................................................................................................4 | | Intended Use........................................................................................................................5 | Intended Use........................................................................................................................5 | | | | EV/XFC Cybersecurity Mission Objectives.......................................................................5 | EV/XFC Cybersecurity Mission Objectives.......................................................................5 | | | Mission Objective 1: Deliver Reliable Performance through Secure Communications.6 | | | | Mission Objective 2: Maintain Resilience of the XFC Infrastructure..............................7 | | | | Mission Objective 3: Build and Maintain Trustworthy Relationships with Partners and Customers..............................................................................................................7 | | | | Mission Objective 4: Maintain Continuity of Operations................................................8 | | | | Overview of the Cybersecurity Framework ......................................................................8 | | | | The Framework Core ....................................................................................................9 | | | | Sector-Level Profiles | ...................................................................................................12 | | | XFC Baseline Profile .........................................................................................................12 | | | | Identify Function..........................................................................................................12 | | | 5.1.1.

Cybersecurity Framework Profile for Electric Vehicle Extreme Fast Charging Infrastructure


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Communications Protection?

[Assistant]
According to Resilient Interdomain Traffic Exchange_ BGP Security and DDoS Mitigation:

|
| [Akamai]     | J. Artega and W. Mejia, 'CLDAP Reflection DDoS,' Akamai Threat Advisory, April 2017.
https://www.akamai.com/kr/ko/multimedia/documents/state-of-the- internet/cldap-threat-advisory.pdf                                                                                |
| [APNIC1]     | G. Michaelson, 'MyAPNIC RPKI service now supports AS0 ROA creation,' APNIC technical note online, November 2018. https://blog.apnic.net/2018/11/09/myapnic-rpki-service-now-supports- as0-roa-creation/                                                                                |
| [Arbor]      | 'NETSCOUT Arbor's 13th Annual Worldwide Infrastructure Security Report' (2018). https://pages.arbornetworks.com/rs/082-KNA- 087/images/13th_Worldwide_Infrastructure_Security_Report.pdf                                                                                |
| [Arbor2]     | 'NETSCOUT Arbor's 14th Annual Worldwide Infrastructure Security Report' (2019). https://www.netscout.com/sites/default/files/2019- 03/SECR_005_EN-1901%E2%80%93WISR.pdf                                                                                |
| [ARIN1]      | 'Using RPKI at ARIN to certify resources,' ARIN online. https://www.arin.net/resources/rpki/using_rpki.html#hosted                                                                                |
| [ARIN2]      | M.

Resilient Interdomain Traffic Exchange_ BGP Security and DDoS Mitigation


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Access Control?

[Assistant]
According to Metrics and Methodology for Hardware Security Constructs:

ory Ranges          |
| CWE-1240 | Use of a Cryptographic Primitive with a Risky Implementation          |
| CWE-1256 | Improper Restriction of Software Interfaces to Hardware Features      |

## 3.1.
Meta Attack Patterns

|   ID | Description                                                     |
|------|-----------------------------------------------------------------|
|  167 | White Box Reverse Engineering                                   |
|  189 | Black Box Reverse Engineering                                   |
|  121 | Exploit Non-Production Interfaces                               |
|   36 | Using Unpublished Interfaces or Functionality                   |
|    1 | Accessing Functionality Not Properly Constrained by ACLs        |
|  180 | Exploiting Incorrectly Configured Access Control Security Level |
|   68 | Subvert Code-signing Facilities                                 |
|  452 | Infected Hardware                                               |
|  456 | Infected Memory                                                 |
|   97 | Cryptanalysis                                                   |
|  625 | Mobile Device Fault Injection                                   |

Metrics and Methodology for Hardware Security Constructs


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Physical Protection?

[Assistant]
According to Cybersecurity Framework Profile for Hybrid Satellite Networks (HSN):

The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the Nation's measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analyses to advance the development and productive use of information technology. ITL's responsibilities include the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national security-related information in federal information systems.

The elements of an HSN may be independently owned, hosted, or virtualized by multiple organizations. While referring to Fig. 2, note that the operator may own the intellectual property that defines the virtualized payload control center (PCC) that is hosted on a third-party cloud service provider (CSP). The virtual PCC interfaces with a physical antenna field independent of the CSP, the operator, and the satellite antenna. All of this is transparent to the operators in organization A when they command, control, communicate or otherwise interact with payload A.

HSN architectures may be complex and involve multiple stakeholders. As shown in Fig. 3, the physical and virtual architecture involves multiple independently owned satellites, uncrewed platforms, ground facilities and crosslinks supporting a range of independent HSNs. The organization that owns and operates the host (A) is operating two satellites that are supporting two independent HSNs (B and C). The operators associated with HSN B interface with a virtual payload command center that controls payloads on separate satellites. The crosslink and radio

Cybersecurity Framework Profile for Hybrid Satellite Networks (HSN)


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Awareness and Training?

[Assistant]
According to Cybersecurity Framework Profile for Electric Vehicle Extreme Fast Charging Infrastructure:

| Asset Management Category..................................................................................13                                                                                |                                                                                |
| 5.1.2. | Business Environment Category.............................................................................19                                                                                |                                                                                |
| 5.1.3. | Governance Category                                                                                | .............................................................................................23                                           |
| 5.1.4. | Risk Assessment Category .....................................................................................26                                                                                |                                                                                |
| 5.1.5. | Risk Management Category....................................................................................29                                                                                |                                                                                |
| 5.1.6.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What guidance does NIST provide for CMMC Level 3?

[Assistant]
According to Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171:

## NIST Special Publication 800-172

## Enhanced Security Requirements for Protecting Controlled Unclassified Information

A Supplement to NIST Special Publication 800-171

RON ROSS VICTORIA PILLITTERI GARY GUISSANIE RYAN WAGNER RICHARD GRAUBART

DEB BODEAU

This publication is available free of charge from:

https://doi.org/10.6028/NIST.SP.800-172

<!-- image -->

## NIST Special Publication 800-172

## Enhanced Security Requirements for Protecting Controlled Unclassified Information

A Supplement to NIST Special Publication 800-171

## RON ROSS VICTORIA PILLITTERI

Computer Security Division

National Institute of Standards and Technology

## GARY GUISSANIE RYAN WAGNER

Institute for Defense Analyses

RICHARD GRAUBART DEB BODEAU

The MITRE Corporation

This publication is available free of charge from:

https://doi.org/10.6028/NIST.SP.800-172

## February 2021

<!-- image -->

U.S. Department of Commerce Wynn Coggins, Acting Secretary

National Institute of Standards and Technology James K. Olthoff, Performing the Non-Exclusive Functions and Duties of the Under Secretary of Commerce for Standards and Technology & Director, National Institute of Standards and Technology

\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

## Authority

This publication has been developed by NIST to further its statutory responsibilities under the Federal Information Security Modernization Act (FISMA), 44 U.S.C. § 3551 et seq. , Public Law (P.L.) 113-283. NIST is responsible for developing information security standards and guidelines, including minimum requirements for federal information systems, but such standards and guidelines shall not apply to national security systems without the express approval of the appropriate federal officials exercising policy authority over such systems.

Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Security Assessment?

[Assistant]
According to Cybersecurity Framework Manufacturing Profile Low Impact Level Example Implementations Guide_ Volume 2 – Process-based Manufacturing System Use Case:

## Periodic Reevaluation of the Program

The Director of Operations shall reevaluate and modify the Program from time to time as deemed appropriate. The Director of Operations shall base such reevaluation and modification on the following:

1. Upon notification of a cybersecurity event, the Director of Operations must determine if the Incident Response Plan should be activated based on available information from event.
2. The Director of Operations must inform all personnel listed in Section 3.5.7 of this document when the response plan has been activated.
3. Impact to the manufacturing system must be determined by thorough investigation, and an incident type and severity level assigned. The Incident Report Template form should be used for this purpose. The severity level will be assigned by the Director of Operations in consultation with the IT Manager.
4. Approval must be received from the CEO and General Counsel if additional resources (i.e., external entities) are to be contacted to assist with incident response (e.g., forensic investigators, IT consultants, cybersecurity consultants, law enforcement, etc.).
5. The Director of Operations or IT Manager must coordinate the Incident Response Plan with stakeholders.
6. User awareness, training, and testing procedures must be reviewed after every incident and updated as necessary.
7. The General Counsel should be involved throughout the incident response due to the potential for legal action arising from the incident.

Cybersecurity Framework Manufacturing Profile Low Impact Level Example Implementations Guide_ Volume 2 – Process-based Manufacturing System Use Case


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice CM.L2-3.4.1 (NIST 3.4.1)?

[Assistant]
According to Guide to SSL VPNs:

3.4.1                                                                                | Versions of SSL and TLS... 3.4.1 through 3. 3.4.1 Versions of SSL and TLS

In this document, the terms SSL and TLS are often used together to describe the same protocol.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Cryptographic Module Validation Program (CMVP)-Approved Security Functions_ CMVP Validation Authority Updates to ISO_IEC 24759 provide? (Part 5)

[Assistant]
................................................................................. 1

Symbols and abbreviated terms......................................................................................
1

Document organization  .................................................................................................... 1

General....................................................................................................................... 1

Modification ................................................................................................................ 2

CMVP-approved security function requirements  ........................................................... 2

Purpose ...................................................................................................................... 2

Approved security functions  ........................................................................................ 2

Appendix A. Document Revisions  ....................................................................................... 3

## Scope

This document specifies the Cryptographic Module Validation Program (CMVP)-approved security functions and supersedes those specified in International Organization for Standardization/International Electrotechnical Commission (ISO/IEC) 19790 Annex C and ISO/IEC 24759 paragraph 6.15. This document also supersedes SP 800-140Cr1. ## Normative references

This section identifies the normative references cited as ISO/IEC 19790 and ISO/IEC 24759. The specific editions to be used are ISO/IEC 19790:2012 and ISO/IEC 24759:2017. Please note that the version 19790:2012 referenced here includes the corrections made in 2015. National Institute of Standards and Technology (2019) Security Requirements for Cryptographic Modules . (U.S. Department of Commerce, Washington, DC), Federal Information Processing Standards Publication (FIPS) 140-3.

Cryptographic Module Validation Program (CMVP)-Approved Security Functions_ CMVP Validation Authority Updates to ISO_IEC 24759


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AU.L2-3.3.2 (NIST 3.3.2)?

[Assistant]
According to Guide to Attribute Based Access Control (ABAC) Definition and Considerations:

3.3.2                                                                                | 3. 3.3.2 Attribute Source Minimization

Minimizing the number of attribute sources used in authorization decisions may improve performance and simplify the overall security management of the ABAC solution.

Guide to Attribute Based Access Control (ABAC) Definition and Considerations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Validated Products List 1995 no. 4_ Programming Languages, Database Language SQL, Graphics, POSIX, Computer Security, Product Data - IGES, OSI provide? (Part 4)

[Assistant]
1-2

1-2

1-2

1-2

1-3

2-1

2-1

2-1

2-2

2-2

2-3

2-3

2-3

2-3

2-4

2-4

3-1

3-1

3-1

3-1

3-2

3-2

3-2

3-2

4-1

4-1

4-1

4-1

4-2

4-2

4-3

4-3

4-3

4-4

5-1

5-1

5-1

5-1

5-1

6.
COMPUTER SECURITY

6.1

6.2

6.3

6.4

6.5

Cryptographic Standards
Data Encryption Validation Tests
Message Authentication Code (MAC) Validation System
Key Management Validation System (KMVS) . General

6.5.1

6.5.2

6.5.3

Request for Validation

Information about Validated Products
Validation Documentation

. 7. PRODUCT DATA CONFORMANCE TESTING

7.1

7.1.1

7.1.2

IGES

Certification
IGES Validated Products

. ,

8. OSI PRODUCTS DATABASE

APPENDIX A FIPS CONFORMANCE TESTING PRODUCTS AND SERVICES

6-1

6-1

6-1

6-1

6-1

6-2

6-2

6-2

6-2

7-1

7-1

7-1

8-1

A-l

1

1. INTRODUCTION

1.1

Purpose

The testing of Information Technology (IT) Products to determine the degree to which they conform to
specific Federal Information Processing Standards (FIPS) may be required by Government agencies as
specified by the FIPS, Federal Information Resources Management Regulation (FIRMR) Parts 201-
20.303, 201-20.304, and 201-39.1002, and the associated Federal ADP and Telecommunications
Products having a current validation certificate or test report may be offered or
Standards Index. delivered by vendors in response to requirements as set forth in solicitations by Federal agencies. The
Validated Products List (VPL) contains conformance testing information for the following IT Standards:

Programming Languages COBOL, Fortran, Ada, Pascal, C, and M[UMPS]
Database Language SQL
Graphics
POSIX
Computer Security
Open Systems Interconnection (OSI)
Product Data (IGES)

This List is updated and published quarterly. The information contained herein is supplied by the
contributors listed in Section 2.6 and Appendix A, and is current as of the tenth of the month preceding
the publication date. Copies of the VPL may be obtained from:

National Technical Information Service
U.S.

Validated Products List 1995 no. 4_ Programming Languages, Database Language SQL, Graphics, POSIX, Computer Security, Product Data - IGES, OSI


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Communications Protection?

[Assistant]
According to Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations:

Chief Information Officer (CIO). The CIO leads the organization's ISCM program. The CIO ensures that an effective ISCM program is established and implemented for the organization by establishing expectations and requirements for the organization's  ISCM program; working closely with authorizing officials to provide funding, personnel, and other resources to support ISCM; and maintaining high-level communications and working group relationships among organizational entities. | Malware [NISTIR 7298]                                     | A program that is inserted into a system, usually covertly, with the intent of compromising the confidentiality, integrity, or availability of the victim's data, applications, or operating system or of otherwise annoying or disrupting the victim.

Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Access Control?

[Assistant]
According to Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations:

| APPENDIX B GLOSSARY.............................................................................................. | B-1                                                                                |
| APPENDIX C ACRONYMS ............................................................................................. | APPENDIX C ACRONYMS ............................................................................................. | C-1                                                                                |
| APPENDIX D TECHNOLOGIES FOR ENABLING ISCM......................................................... | APPENDIX D TECHNOLOGIES FOR ENABLING ISCM......................................................... | D-1                                                                                |


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 1 require for Security Assessment?

[Assistant]
According to Workshop Summary Report for “Building the Federal Profile For IoT Device Cybersecurity” Virtual Workshop:

Manufacturer support comprises a number of activities, especially documentation and software updates. An on-going challenge for customers and users in assessing and improving IoT device cybersecurity is inadequate documentation of device characteristics. Lack of documentation hinders both security assessments and the ability to select compensating security controls to address IoT device cybersecurity shortcomings. While some manufacturers do provide substantive documentation, many provide very little, leaving customer organizations starved for information on which to base risk assessments. Both the development of security solutions and the assessment of those solutions require information about, for example, the network communications patterns expected for IoT devices. Manufacturer communications regarding IoT device cybersecurity need to address a range of audiences with diverse levels of sophistication and understanding of the cybersecurity challenge. This includes communication both at the consumer level and with organizational procurement activities. Vendors need to convey information about product operation and about using device cybersecurity features, as well as more general communications regarding manufacturer procedures and commitments for vulnerability disclosure, software update frequency and mechanisms, and duration of support commitments for IoT products. Derail Heiland explained 'we need to be able to get detailed information around those specific security topics on how do we reduce risk by properly implementing. How do we deploy into our organization? How do we get the detailed information to help us make those security risks evaluations for better deploying the technology? Often we are not seeing that information.'

The introduction of IoT devices creates significant challenges for security assessment of federal information systems.

Workshop Summary Report for “Building the Federal Profile For IoT Device Cybersecurity” Virtual Workshop


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Services Acquisition?

[Assistant]
According to Guidelines for Evaluating Differential Privacy Guarantees:

There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may be used by federal agencies even before the completion of such companion publications. Thus, until each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For planning and transition purposes, federal agencies may wish to closely follow the development of these new publications by NIST. The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the Nation's measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analyses to advance the development and productive use of information technology. ITL's responsibilities include the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national security-related information in federal information systems. The Special Publication 800series reports on ITL's research, guidelines, and outreach efforts in information system security, and its collaborative activities with industry, government, and academic organizations. Unfortunately, de-identifying data is challenging in practice because it is difficult to distinguish identifying information from non-identifying information. Every person has a unique combination of features. Any one feature (e.g., gender or age) my not be uniquely identifying on its own, but as features accumulate they inevitably become uniquely identifying in combination. As a result, de-identified data nearly always contains some information that could be identifying.

Guidelines for Evaluating Differential Privacy Guarantees


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] How does IoT Device Cybersecurity Capability Core Baseline support CMMC certification?

[Assistant]
According to IoT Device Cybersecurity Capability Core Baseline:

ts, guidelines, and procedures, where they exist, remain operative. For planning and transition purposes, federal agencies may wish to closely follow the development of these new publications by NIST.
Organizations are encouraged to review all draft publications during public comment periods and provide feedback to NIST. Many NIST cybersecurity publications, other than the ones noted above, are available at https://csrc.nist.gov/publications. ## Comments on this publication may be submitted to:

National Institute of Standards and Technology Attn: Applied Cybersecurity Division, Information Technology Laboratory 100 Bureau Drive (Mail Stop 2000) Gaithersburg, MD 20899-2000

Email: iotsecurity@nist.gov

All comments are subject to release under the Freedom of Information Act (FOIA). ## Reports on Computer Systems Technology

The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the Nation's measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analyses to advance the development and productive use of information technology. ITL's responsibilities include the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national security-related information in federal information systems. ## Abstract

Device cybersecurity capabilities are cybersecurity features or functions that computing devices provide through their own technical means (i.e., device hardware and software). This publication defines an Internet of Things (IoT) device cybersecurity capability core baseline, which is a set of device capabilities generally needed to support common cybersecurity controls that protect an organization's devices as well as device data, systems, and ecosystems.

IoT Device Cybersecurity Capability Core Baseline


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Risk Assessment?

[Assistant]
According to Guide to LTE Security:

| Purpose and Scope ........................................................................................
| 6                                                                                |
|                                                                                | 1.2                                                                                | Document Structure........................................................................................ | 6                                                                                |
|                                                                                | 1.3                                                                                | Document Conventions...................................................................................


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AT.L2-3.2.1 (NIST 3.2.1)?

[Assistant]
According to Guidelines for API Protection for Cloud-Native Systems:

3.2.1. 3.2.1.

Guidelines for API Protection for Cloud-Native Systems


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Communications Protection?

[Assistant]
According to Recommendation for Random Bit Generator (RBG) Constructions:

Standards and Technology (2019) Security Requirements for Cryptographic Modules. (Department of Commerce, Washington, DC), Federal Information Processing Standards Publication (FIPS) NIST FIPS 140-3.
https://doi.org/10.6028/NIST.FIPS.140-3                                        |
| [FIPS_140IG]  | National Institute of Standards and Technology, Canadian Centre for Cyber Securit y (2020) Implementation Guidance for FIPS 140-3 and the Cryptographic Module Validation Program, [Amended April 18, 2025]. |
| [FIPS_180]    | National Institute of Standards and Technology (2015) Secure Hash Standard (SHS). (Department of Commerce, Washington, DC), Federal Information Processing Standards Publication (FIPS) NIST FIPS 180-4. |
| [FIPS_197]    | https://doi.org/10.6028/NIST.FIPS.180-4 National Institute of Standards and Technology (2001) Advanced Encryption Standard (AES). (Department of Commerce, Washington, DC), Federal Information Processing Standards Publication (FIPS) NIST FIPS 197-                                                       |
| [FIPS_202]    | National Institute of Standards and Technology (2015) SHA-3 Standard: Permutation-Based Hash and Extendable-Output Functions. (Department of Commerce, Washington, DC), Federal Information Processing                                                                                |
| [ISO_18031]   | https://doi.org/10.6028/NIST.FIPS.202 International Organization for Standardization/International Electrotechnical Commission (2025) ISO/IEC 18031:2025 Information technology -Security techniques-Randombitgeneration (International Organization for Standardization, Geneva, Switzerland). Available at |
| [NISTIR_8427] | https://www.iso.org/standard/81645.html Buller D, Kaufer A, Roginsky AL, Sonmez Turan M(2022) Discussion on the Full Entropy Assumption of SP 800-90 Series.

Recommendation for Random Bit Generator (RBG) Constructions


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AU.L2-3.3.6 (NIST 3.3.6)?

[Assistant]
According to Cybersecurity Framework Manufacturing Profile Low Impact Level Example Implementations Guide_ Volume 3 – Discrete-based Manufacturing System Use Case:

3.3.6. 3.3.6. 3.3.6.

Cybersecurity Framework Manufacturing Profile Low Impact Level Example Implementations Guide_ Volume 3 – Discrete-based Manufacturing System Use Case


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does The NIST Definition of Cloud Computing provide? (Part 3)

[Assistant]
minimum  requirements,  for providing  adequate  information  security  for  all  agency  operations  and  assets;  but  such  standards  and guidelines shall not apply to national security systems.
This guideline is consistent with the requirements of  the  Office  of  Management  and  Budget  (OMB)  Circular  A-130,  Section  8b(3),  'Securing  Agency Information  Systems,'  as  analyzed  in  A-130,  Appendix  IV:  Analysis  of  Key  Sections. Supplemental information is provided in A-130, Appendix III. This  guideline  has  been  prepared  for  use  by  Federal  agencies. It  may  be  used  by  nongovernmental organizations on a voluntary basis and is not subject to copyright, though attribution is desired. Nothing in this document should be taken to contradict standards and guidelines made mandatory and binding on Federal agencies by the Secretary of Commerce under statutory authority, nor should these guidelines be interpreted as altering or superseding the existing authorities of the Secretary of Commerce, Director of the OMB, or any other Federal official. ## 1.2 Purpose and Scope

Cloud computing is an evolving paradigm. The NIST definition characterizes important aspects of cloud computing and is intended to serve as a means for broad comparisons of cloud services and deployment strategies, and to provide a baseline for discussion from what is cloud computing to how to best use cloud computing. The service and deployment models defined form a simple taxonomy that is not intended to prescribe or constrain any particular method of deployment, service delivery, or business operation. ## 1.3 Audience

The intended audience of this document is system planners, program managers, technologists, and others adopting cloud computing as consumers or providers of cloud services. ## 2.

Planning
System and Services Acquisition
Physical Protection
Awareness and Training
Incident Response
Configuration Management
Maintenance
Security Assessment
System and Communications Protection
Media Protection
Risk Assessment
Audit and Accountability
Personnel Security
Identification and Authentication
Access Control
System and Information Integrity


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Configuration Management?

[Assistant]
According to Implementation of DevSecOps for a Microservices-based Application with Service Mesh:

| Executive Summary......................................................................................................v   | Executive Summary......................................................................................................v                                                                  | Executive Summary......................................................................................................v                                                                  |
|----------------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| 1                                                                                | Introduction ............................................................................................................1                                                                |                                                                                |
|                                                                                | 1.1 Scope................................................................................................................

Implementation of DevSecOps for a Microservices-based Application with Service Mesh


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice CM.L2-3.4.2 (NIST 3.4.2)?

[Assistant]
According to Foundational PNT Profile_ Applying the Cybersecurity Framework for the Responsible Use of Positioning, Navigation, and Timing (PNT) Services:

3.4.2, 3.

Foundational PNT Profile_ Applying the Cybersecurity Framework for the Responsible Use of Positioning, Navigation, and Timing (PNT) Services


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Recommendations for Federal Vulnerability Disclosure Guidelines provide? (Part 3)

[Assistant]
inh H, Van Wyk I (2023) Recommendations for Federal Vulnerability Disclosure Guidelines. (National Institute of Standards and Technology, Gaithersburg, MD), NIST (Special Publication) NIST SP 800-216.
https://doi.org/10.6028/NIST.SP.800-216

## Author ORCID iDs

Kim Schaffer: 0000-0003-3073-2395

Peter Mell: 0000-0003-2938-897X

Hung Trinh: 0000-0002-3323-0836

Isabel Van Wyk: 0000-0001-8566-6829

## Contact Information

sp800-216-comments@nist.gov

National Institute of Standards and Technology Attn: Computer Security Division, Information Technology Laboratory 100 Bureau Drive (Mail Stop 8930) Gaithersburg, MD 20899-8930

All comments are subject to release under the Freedom of Information Act (FOIA). ## Abstract

Receiving reports on suspected security vulnerabilities in information systems is one of the best ways for developers and services to become aware of issues. Formalizing actions to accept, assess, and manage vulnerability disclosure reports can help reduce known security vulnerabilities. This document recommends guidance for establishing a federal vulnerability disclosure framework, properly handling vulnerability reports, and communicating the mitigation and/or remediation of vulnerabilities. The framework allows for local resolution support while providing federal oversight and should be applied to all software, hardware, and digital services under federal control. ## Keywords

advisory; Federal Coordination Body; findings report; source vulnerability report; vulnerability communication; Vulnerability Disclosure; Vulnerability Disclosure Policy; Vulnerability Disclosure Program Office; vulnerability processing; vulnerability tracking. ## Reports on Computer Systems Technology

The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the Nation's measurement and standards infrastructure.

Recommendations for Federal Vulnerability Disclosure Guidelines


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What guidance does Usability and Security Considerations for Public Safety Mobile Authentication provide?

[Assistant]
## NISTIR 8080

## Usability and Security Considerations for Public Safety Mobile Authentication

Yee-Yin Choong Joshua M. Franklin Kristen K. Greene

This publication is available free of charge from: http://dx.doi.org/10.6028/NIST.IR.8080

<!-- image -->

## NISTIR 8080

## Usability and Security Considerations for Public Safety Mobile Authentication

Yee-Yin Choong Kristen K. Greene Information Access Division Information Technology Laboratory

Joshua M. Franklin Applied Cybersecurity Division Information Technology Laboratory

This publication is available free of charge from: http://dx.doi.org/10.6028/NIST.IR.8080

July 2016

<!-- image -->

U.S. Department of Commerce Penny Pritzker, Secretary

National Institute of Standards and Technology Willie May, Under Secretary of Commerce for Standards and Technology and Director

## National Institute of Standards and Technology Interagency Report 8080 3 9 pages (July 2016)

## This publication is available free of charge from: http://dx.doi.org/10.6028/NIST.IR.8080

Certain  commercial  entities,  equipment,  or  materials  may  be  identified  in  this  document  in  order  to  describe  an experimental  procedure  or  concept  adequately. Such  identification  is  not  intended  to  imply  recommendation  or endorsement by NIST, nor is it intended to imply that the entities, materials, or equipment are necessarily the best available for the purpose. There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may be  used  by  Federal  agencies  even  before  the  completion  of  such  companion  publications. Thus,  until  each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative.

Usability and Security Considerations for Public Safety Mobile Authentication


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Identification and Authentication?

[Assistant]
According to NIST Privacy Framework_ A Tool for Improving Privacy Through Enterprise Risk Management, Version 1.0:

800-39. https://doi.org/10.6028/NIST.SP.800-39
- [7] Joint Task Force (2018) Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy.
(National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) 800-37 Rev. 2. https://doi.org/10.6028/NIST.SP.800-37r2
- [8] Grassi PA, Garcia ME, Fenton JL (2017) Digital Identity Guidelines. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) 800-63-3, Includes updates as of December 1, 2017. https://doi.org/10.6028/NIST.SP.800-63-3
- [9] Office of Management and Budget (2017) Preparing for and Responding to a Breach of Personally Identifiable Information. (The White House, Washington, DC), OMB Memorandum M-17-12, January 3, 2017. Available at https://www.whitehouse.gov/sites/whitehouse.gov/files/omb/memoranda/2017/m-17-12\_0.pdf
- [10] Joint Task Force Transformation Initiative (2013) Security and Privacy Controls for Federal Information Systems and Organizations. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) 800-53, Rev. 4, Includes updates as of January 22, 2015. https://doi.org/10.6028/NIST.SP.800-53r4
- [11] Grassi PA, Lefkovitz NB, Nadeau EM, Galluzzo RJ, Dinh AT (2018) Attribute Metadata: A Proposed Schema for Evaluating Federated Attributes. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Interagency or Internal Report (IR) 8112. https://doi.org/10.6028/NIST.IR.8112

NIST Privacy Framework_ A Tool for Improving Privacy Through Enterprise Risk Management, Version 1.0


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AT.L2-3.2.6 (NIST 3.2.6)?

[Assistant]
According to Secure Software Development Framework (SSDF) Version 1.1_ Recommendations for Mitigating the Risk of Software Vulnerabilities:

3.2.6 SP800161 : SA-8 SP800181 : OV-TEA-001, OV-TEA-002; T0030, T0073, T0320; K0204, K0208, K0220, K0226, K0243, K0245, K0252; S0100, S0101; A0004, A0057 |

5 Provenance is 'the chronology of the origin, development, ownership, location, and changes to a system or system component and associated data.

Secure Software Development Framework (SSDF) Version 1.1_ Recommendations for Mitigating the Risk of Software Vulnerabilities


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Supply Chain Risk Management?

[Assistant]
According to Risk Management Framework for Information Systems and Organizations_ A System Life Cycle Approach for Security and Privacy:

curity officer; senior agency official for privacy; supply chain risk management; system development life cycle; system owner; system privacy officer; system security officer; system-specific control.
As we push computers to 'the edge,' building a complex world of interconnected information systems and devices, security and privacy risks (including supply chain risks) continue to be a large part of the national conversation and topics of great importance. The significant increase in the complexity of the hardware, software, firmware, and systems within the public and private sectors (including the U.S. critical infrastructure) represents a significant increase in attack surface that can be exploited by adversaries. Moreover, adversaries are using the supply chain as an attack vector and effective means of penetrating our systems, compromising the integrity of system elements, and gaining access to critical assets.

Risk Management Framework for Information Systems and Organizations_ A System Life Cycle Approach for Security and Privacy


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AC.L2-3.1.6 (NIST 3.1.6)?

[Assistant]
According to Guidelines on Active Content and Mobile Code:

3.1.6 Configuration of Software

Understanding a system's security posture and correctly setting its configuration is an unrealistic expectation for the general population.

Guidelines on Active Content and Mobile Code


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Standard Security Label for GOSIP_ an Invitational Workshop provide? (Part 5)

[Assistant]
| , "Security Labels at the Transport Layer" (Presentation Slides) , Wayne A.
Jansen (NIST) -                                                                                | 95  |
| Comments on the draft FIPS "Standard Security Label for the Government Open Systems Interconnection Profile" (Position Paper) , Russell Housley, Sammy Migues (Xerox Special Information Systems) "The Multipolicy Machine - A New Paradigm for Multilevel Security Systems" (Position Paper) , Hilary Hosmer (Data Security, Inc.) | Comments on the draft FIPS "Standard Security Label for the Government Open Systems Interconnection Profile" (Position Paper) , Russell Housley, Sammy Migues (Xerox Special Information Systems) "The Multipolicy Machine - A New Paradigm for Multilevel Security Systems" (Position Paper) , Hilary Hosmer (Data Security, Inc.) | 105 |
| "Modelling Security Policy and Labelling Unclassified but Sensitive Information - A Canadian (Position Paper) , D.S. Crawford (Canadian Department National                                                                                | "Modelling Security Policy and Labelling Unclassified but Sensitive Information - A Canadian (Position Paper) , D.S.

Standard Security Label for GOSIP_ an Invitational Workshop


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does ISCMA_ An Information Security Continuous Monitoring Program Assessment provide? (Part 3)

[Assistant]
aft publications during public comment periods and provide feedback to NIST. Many NIST cybersecurity publications, other than the ones noted above, are available at https://csrc.nist.gov/publications.
## Comments on this publication may be submitted to:

National Institute of Standards and Technology Attn: Computer Security Division, Information Technology Laboratory 100 Bureau Drive (Mail Stop 8930) Gaithersburg, MD 20899-8930

Email: sec-cert@nist.gov

All comments are subject to release under the Freedom of Information Act (FOIA). ## Reports on Computer Systems Technology

The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes  the  U.S. economy  and  public  welfare  by  providing  technical  leadership  for  the  Nation's measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analyses to advance the development and productive use of information technology. ITL's responsibilities include the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national security-related information in federal information systems. ## Abstract

This publication describes an example methodology for assessing an organization's Information Security Continuous Monitoring (ISCM) program. It was developed directly from NIST guidance and is applicable to any organization, public or private. It can be used as documented or as the starting point for a different methodology. Included with the methodology is a reference implementation that is directly usable for conducting an ISCM assessment. ## Keywords

assessment; continuous monitoring; information security continuous monitoring; information security continuous monitoring assessment; ISCM; ISCMA; ISCMAx.

ISCMA_ An Information Security Continuous Monitoring Program Assessment